Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2024, 19:39 UTC

General

  • Target

    JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll

  • Size

    171KB

  • MD5

    d66afafdc9ad8cc4135e1bab32cb0cdd

  • SHA1

    e0550c10cb1b616fcc44f2cdeef8c6379192abda

  • SHA256

    07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1

  • SHA512

    7a264f9e00b565c8c60201ef02aaddb10a82481efd9515989c6f676f5bba4276958351541dd15efd1f8c0847d489281e4cf878e1af653ec36f8032886f9e0e73

  • SSDEEP

    3072:oi49mEb06hs9BPEmmvt7dNbTqub9Un7WpVJBR13LSoAH7Dk0ZT:oH9RVaPEmsdHdbQUbd2H3

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

128.199.200.38:443

192.163.233.216:6601

43.229.206.244:4125

rc4.plain
1
e8Tv13iGxjzB4XfTjyfX2ZjB8EnMq5sQ0YbGaHvfvzJJOUoCCTU
rc4.plain
1
DwIOaGXzKtiA9zdrD77uFJEoIixZk63d8IwoSuRAVBG2oa3BiOXdwVg

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex family
  • Dridex Loader 2 IoCs

    Detects Dridex both x86 and x64 loader in memory.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07adce3d198541f89ed20ede2c27c81801caefe61eac8ca381b83639737228e1.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5024
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 664
        3⤵
        • Program crash
        PID:448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5024 -ip 5024
    1⤵
      PID:968

    Network

    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      133.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      53.210.109.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      53.210.109.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.42.69.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.42.69.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      196.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.190.18.2.in-addr.arpa
      IN PTR
      Response
      196.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-196deploystaticakamaitechnologiescom
    • flag-us
      DNS
      134.130.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.130.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      133.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      133.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      53.210.109.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      53.210.109.20.in-addr.arpa

    • 8.8.8.8:53
      241.42.69.40.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      241.42.69.40.in-addr.arpa

    • 8.8.8.8:53
      196.190.18.2.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      196.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      134.130.81.91.in-addr.arpa
      dns
      72 B
      147 B
      1
      1

      DNS Request

      134.130.81.91.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      210 B
      133 B
      3
      1

      DNS Request

      88.210.23.2.in-addr.arpa

      DNS Request

      88.210.23.2.in-addr.arpa

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/5024-0-0x00000000012D0000-0x00000000012D6000-memory.dmp

      Filesize

      24KB

    • memory/5024-1-0x0000000074D80000-0x0000000074DB0000-memory.dmp

      Filesize

      192KB

    • memory/5024-2-0x0000000074D80000-0x0000000074DB0000-memory.dmp

      Filesize

      192KB

    • memory/5024-3-0x00000000012D0000-0x00000000012D6000-memory.dmp

      Filesize

      24KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.